Privacy and Cookies Policy

Mole Valley District Council ("MVDC") is the body exercising control over the purpose for which and the manner in which your personal data is processed.

Data Controller's contact details:

MVDC Pippbrook, Dorking RH4 1SJ. Telephone: 01306 885 001

Data Protection Officer:

Mr Tom Penlington (Solicitor): Telephone: 01306 879 354

The legal basis for and the purposes of the processing:

Legal Basis:

MVDC will only process your personal data if it is fair and lawful to do so. It will only be lawful for MVDC to process your personal data if one of the conditions in paragraph (A) below applies to the processing of your personal information.

(A) Conditions to make the processing of personal information lawful:

You have given your consent to the processing,

You have entered into (or about to enter into) a contract with MVDC and the contract cannot be performed without the processing,

MVDC is under a legal duty to process you personal information (for example in respect of its Council Tax or Housing functions),

There is an emergency (potentially a life or death) situation and the processing is necessary in order to protect you or somebody else,

MVDC is carrying out its powers in the public interest or other official authority (the power will be set out in legislation or case law),

If your personal information is sensitive (or special category) personal data then one of the conditions in paragraph (B) immediately below must also apply.

(B) Conditions to make the processing of sensitive personal information lawful:

You have given your explicit consent to the processing (for specific purposes) - this is unless there is a law in place which means that you are not allowed to consent.

The processing is necessary for the purposes of carrying out rights and obligations of either MVDC, or you, in one of the following areas: (i) employment, (ii) social security, or (iii) social protection law. Appropriate safeguards to protect your fundamental rights and interests will need to be in place.

There is an emergency (potentially a life or death) situation and the processing is necessary in order to protect you or somebody else,

You have previously made the personal information public,

The processing is necessary in connection with establishing, exercising or defending legal claims,

The processing is necessary for reasons of substantial public interest pursuant to rights and obligations set out in legislation. Where this condition is used, the processing must still (i) provide appropriate safeguards to protect you, and (ii) be proportionate - so the risk is justified in the context of how important the processing is

The processing is necessary for the purposes of (i) preventative or occupational medicine, (ii) the assessment of the working capacity of the employee, (iii) medical diagnosis, (iv) the provision of health or social care or treatment or the management of health or social care systems pursuant to a contract with a health professional and subject to certain safeguards being in place,

The processing is necessary for the reasons of public interest in the area of public health (eg, protecting against serious cross border threats to health) or ensuring high standards of quality and safety of health care and of medicinal products or medical devices (again with safeguards in place to protect you), or

The processing is necessary for archiving purposes in the public interest or for certain research purposes.

Sensitive (or special category) personal information has a specific definition in the GDPR. This means that your personal data will fall within one of the following categories: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning somebody's sex life (or sexual orientation).

Please note that there is a separate Privacy Notice available which will inform data subjects how their personal information will be processed by MVDC in its capacity as an employer.

What bodies this Privacy Notice will apply to:

Mole Valley District Council (though a separate Privacy Notice will apply to processing of personal information by MVDC in its capacity as an employer),

Members ([where they are acting on MVDC business only], and

Companies that are wholly owned by MVDC (subject to adoption by the companies).

A separate Privacy Notice is available in respect of processing by or for and on behalf of the Elections Registration Officer and Returning Officer (including processing by MVDC staff when performing such duties).

People who we process personal information about:

In addition to our residents we process personal information about the following:

Staff; Persons contracted to provide a service, and persons receiving a service; Claimants; Complainants, enquirers and their representatives; Professional advisers and consultants; Youths (for example in connection with MVDC's Youth Council); Carers or representatives of persons in need of specific services; Landlords and prospective landlords; Recipients of benefits; Witnesses; Offenders and suspected offenders; Licence and permit holders; Traders and others subject to inspection; People captured by CCTV images; Representatives of partner and other organisations

The purposes of the processing:

Personal information will be processed for a wide variety of reasons. The majority of the processing will be in connection with MVDC's functions (i.e., all of the obligations and powers to act (or omit from acting)) that MVDC must, or is able to do (or refrain from doing)).

The processing performed by MVDC in connection with its functions will sit within one of the following Service areas (some of which are internal Services, with a number of those Service functions covered by this wider privacy notice):

Regeneration and Investment

Strategy & Corporate Support

MVDC may (or will) process your personal information where we have an obligation or a power to do so. Processing is defined very widely in the General Data Protection and in addition to disclosing the information to other persons (whether internally or externally) also includes, for example: collecting, holding, altering, consulting on, restricting, erasing or destroying. It will therefore apply, for example to the storing of your personal information on MVDC's systems in whatever media is used, for example electronic files, databases and e mails, hard copy files, photographs, audio (eg, the recording of your telephone calls when you contact MVDC), video (eg, the CCTV cameras in and around MVDC's Pippbrook Offices). Because the definition of personal data has changed, it will also apply to electronic information collected in respect of visitors to MVDC's website, and please refer to the cookies section at the end of this Privacy Notice.

In respect of telephone calls to MVDC, your call may be recorded and that recording may be kept for up to 6 weeks. The main reason why your call is recorded is to protect both parties to the call. If there is a dispute about the contents of the call, for example, then the recording may be referred to during the retention period to help resolve any disagreement. Callers to our main number 01306 885001 will hear a recorded message advising that calls may be recorded. If you have a dispute and need to obtain a copy of a call recording please contact kate.butcher@molevalley.gov.uk in the first instance.

People that we may disclose the personal information to include:

Internal or external auditors; Customers; Family, associates or representatives of the person whose personal data we are processing; The Charities Commission; Current past and prospective employers; Healthcare, social and welfare organisations; Educators and examining bodies; Providers of goods and services; Financial organisations; Debt collection and tracing agencies; MVDC's insurance company; Private investigators; Service Providers; Local Government, Central Government, and other bodies providing services on their behalf; The Ombudsman and regulatory authorities; Press and the Media; Professional advisers (eg, external solicitors and barristers) and consultants; Courts and Tribunals; Trade Unions; Political organisations; Credit reference agencies; Professional bodies; Survey and research purposes; Police forces and other law enforcement or prosecuting authorities; Housing associations and landlords; Voluntary and charitable organisations; Religious organisations; Data Processors (i.e., third parties who process personal information for and on behalf of MVDC (excluding MVDC staff)); Regulatory bodies; HMRC; Partner agencies,; Joint working bodies (eg, Southern Building Control Partnership in respect of information held on the systems of MVDC, Reigate and Banstead D.C. and Tandridge D.C.); Licensing Authorities; The Disclosure and Barring Service.

It is therefore important, that if you provide us with personal information about you that you keep this relevant (to the reason why your personal data is being processed by MVDC). Please do not provide any personal information that you consider is excessive or irrelevant (in the context of why your personal data is being processed by MVDC).

Members (Councillors)

Members have three separate roles in respect of how they process personal data. These are as follows:

(i) MVDC Business: When Members process the personal data of their residents on MVDC business (eg, when processing personal data in their capacity as a member of an MVDC Committee or a Portfolio holder), then this processing will take place for and on behalf of MVDC, and so MVDC will be the Data Controller. If none of the other conditions apply that enable lawful processing (referred to above (re personal data) and below (re sensitive personal data), then you will be asked for your consent to the processing. If you agree to consent to the processing then you can withdraw that consent at any time. You will be informed how to withdraw consent in the form (or other medium) at the same time as you are asked for consent.

(ii) business connected to an elected representative's political party: When the processing of personal information is performed for and on behalf of a political party, for example when campaigning at election time on behalf of a political party, such processing is entirely separate to MVDC. Please refer to the political party's Privacy Notice and Data Protection Policy for further information (see (iii) below for independent councillors).

(iii) Other matters: The individual member will be the data controller in respect of the processing of all other personal data processed by elected members (in that capacity); for example, responding to requests about pot holes, fly tipping and traffic issues, or where the elected member is an independent councillor. Members may, if they wish, use MVDC's General Privacy Notice and Data Protection and other relevant policies for this processing, or they may (at their discretion) use their own. Please contact the individual member concerned for further information. MVDC Councillors are often required to sit or are asked to sit on the governing committees (or similar) of external organisations. MVDC may invite persons within those organisations to participate in any such consultations. There is no requirement to respond to any such consultation, or to include any personal data within any such response. Where personal data is received in a response, this will be deleted/ destroyed within 2 years of receipt.

Further information on onward transfers:

MVDC will not transfer the personal data you have provided outside of the UK or European Union unless this is permitted in accordance with the General Data Protection Regulation or the Data Protection Act 2018.

MVDC will not routinely make decisions which affect your rights and freedoms using automated means alone. If automated decision making is being used, then further details will be provided on the specific notice for the relevant service.

Data Subject Rights:

From 25 May 2018 you will have some specific rights in respect of your personal data. The rights available to data subjects are set out below. Please note, these will not all apply in every situation. The rights available to you will be set out in the specific Privacy Notice for your service area, and/ or you will receive an explanation as to why any right that you would like to exercise does not apply:

The right of subject access. You have the right to see what personal data about you MVDC holds at any time (subject to certain caveats, for example where third parties are identified);

have MVDC correct any errors (if any) in the personal data it holds about you, and to have incomplete personal data completed;

request some or all of the personal data held about you is erased (though this right will not apply, for example, where MVDC is processing your personal data because it is necessary to comply with a legal obligation);

The right to be informed of any changes made to your personal data as a result of (i) rectification, (ii) erasure, or (iii) restriction. Third party recipients of your personal data will also be informed unless to do so would be impossible or involve disproportionate effort.

request processing of your personal data is restricted (this will only apply in certain situations, for example where its accuracy is contested, where the processing is unlawful and the you oppose its proposed erasure by MVDC, or where MVDC no longer needs to process the personal data, but it is required by you in connection with legal claims);

object to the processing where the processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the data controller (though MVDC will still be able to continue with the processing in certain circumstances, such as if there are compelling grounds for the processing which over ride your interests).

If your personal data is used by MVDC to make automated decisions about you, then you have the right to object to this.

Be provided with a copy of your personal data in an accessible electronic format (please note there are limited circumstances in which this right will apply).

Will the personal data be processed for a different purpose?

MVDC will not generally process the personal information about you for purposes that are not compatible with the reason why it was collected (and as referred to in the relevant Privacy Notice). There are, however, some exceptions where that processing is required or permitted by law.

Google Analytics

MVDC uses Google Analytics software to collect information about how you use www.molevalley.gov.uk. MVDC does this to help make sure the site is meeting the needs of its users and to help us make improvements.

The cookies MVDC uses for this purpose are:

Universal Analytics

Name

Purpose

Expires

_ga

This helps us count how many people visit molevalley.gov.uk by tracking if you've visited before

2 years

_gid

This helps us count how many people visit by tracking if you've visited before

24 hours

_gat

Used to manage the rate at which page view requests are made

10 minutes

Google Analytics

Name

Purpose

Expires

_utma

Like _ga, this lets us know if you've visited before, so we can count how many of our visitors are new to GOV.UK or to a certain page

2 years

_utmb

This works with _utmc to calculate the average length of time you spend on GOV.UK

30 minutes

_utmc

This works with _utmb to calculate when you close your browser

When you close your browser

_utmz

This tells us how you reached GOV.UK (for example from another website or a search engine)

6 months

How do I prevent being tracked by Google Analytics?

If you are uncomfortable with this tracking, you can take the following actions: